Aztec AI Group
 

Subscribe free to get each new issue by email. Unsubscribe at any time.

Your one-stop briefing on AI and quantum risk. Written for board members, executives and senior leaders. Each issue covers the good, the bad and the ugly of AI, the latest news on quantum risk and regulation, and what it means for decision makers. You will also find books, white papers and the DIRECT framework, a method used in boardrooms to make critical decisions traceable, defensible and deliverable. These are created by Bridget Convey, founder of Aztec AI Group and Aztec AI Compliance, which provide ready-made AI governance products and services. She has 30 years experience implementing complex regulatory transformation across financial services, insurance and asset management, and now consults as an AI subject matter expert with Charterhouse Consultants.

1. The Good, the Bad and the Ugly

The Good: The FCA shows what good AI looks like
On 19 October 2026 the Financial Conduct Authority published its review of how firms are using AI. The best firms decided up front where AI should support, automate or hand over to a person, and could show their controls work in practice. [1]
Board lesson: Ask your executive: where does AI hand over to a person, and how do we know that works?
The Bad: Made-up case citations are still reaching the courts
On 17 August 2026 the Solicitors Regulation Authority issued a warning notice on the misuse of AI. It confirms that solicitors remain responsible for AI-assisted work, that every citation must be checked as genuine, and that supervisors can be in breach if false citations reach the court. [2]
Board lesson: AI output is a draft, never evidence. Someone named must check it.
The Ugly: AI agents that did not stay in their lane
On 14 October 2026 the European Commission said the EU AI Office has sent its first formal requests for information to providers of the most advanced AI models, covering security, external evaluation and monitoring after release, following reported incidents where AI agents acted beyond their intended limits. [3]
Board lesson: If you use AI agents, can you switch them off quickly, and who is allowed to?

2. AI Risk

  • Retrospective governance: the FCA found some firms built and launched AI first, then tried to fit it into existing governance. Action: no AI goes live without sign off against your risk framework. [1]
  • Box-ticking oversight: human review sometimes became a formality. Action: make sure reviewers have the skill and the authority to stop an output. [1]
  • Supplier lock-in: some firms depend on AI providers that are hard to replace, with no exit plan. Action: add AI suppliers to your exit planning. [1]

3. Quantum Risk

  • The UK National Cyber Security Centre has set three dates for moving to quantum-safe encryption: by 2028, find every system that depends on cryptography and draft a plan; by 2031, finish the highest priority migrations; by 2035, finish migrating everything. [4]
  • Why act now: data stolen today can be stored and decrypted later, once quantum computers are powerful enough. Waiting is the risk.
  • Board question: has anyone been asked to own our cryptography inventory, and will 2028 be met?

4. Compliance Officer for Legal Practice (COLP)

  • Must act: the SRA warning notice of 17 August 2026 expects firms to have governance and controls for AI, to check every citation, and to keep client data in AI tools secure and out of model training unless authorised. [2]
  • Should know: supervisors can be in breach if AI-generated errors reach the court without adequate review. Review who checks junior staff's AI-assisted work. [2]
  • Watching: the SRA has consulted on how technology and AI affect solicitors' learning and development. We will report the outcome. [5]

5. Regulations and Frameworks

  • EU AI Act: Regulation (EU) 2026/1744 (the Digital Omnibus on AI) entered into force on 27 July 2026. High-risk duties for Annex III systems now apply from 2 December 2027, and for Annex I systems from 2 August 2028. [6]
  • Key date: generative AI systems already on the market before 2 August 2026 must meet the Article 50(2) transparency marking rules by 2 December 2026. [6]
  • Ireland: the Regulation of Artificial Intelligence Act 2026 came into operation on 31 July 2026 under SI No 403 of 2026, setting up Ireland's national AI Act enforcement. [7]

6. Latest News

  • FCA AI Live Testing: eight firms, including two large UK banking groups, are testing AI in live conditions with the FCA. Testing ends in 2026 and an evaluation report is due in early 2027. [8]
  • NIST has moved nine candidate algorithms into the third round of its search for additional quantum-safe digital signatures, a process expected to take about two years. [9]
  • The European AI Office's information requests (see The Ugly) are the first formal step under the AI Act's rules for general-purpose AI models. No fines have been announced. [3]

7. Further Reading

  1. Financial Conduct Authority (2026) AI in financial services: good practice and areas for improvement, 19 October.
  2. Solicitors Regulation Authority (2026) Warning notice: misuse of AI, 17 August.
  3. European Commission (2026) Press statement, Executive Vice-President Virkkunen, Dublin, 14 October (as reported via the Commission press corner).
  4. National Cyber Security Centre (2025) Timelines for migration to post-quantum cryptography, 20 March.
  5. Today's Conveyancer (2026) SRA consults on impact of technology and AI on solicitors' learning and development.
  6. European Union (2026) Regulation (EU) 2026/1744 (Digital Omnibus on AI), via AI Act Explorer.
  7. Department of Enterprise, Tourism and Employment (2026) SI No 403 of 2026.
  8. Financial Conduct Authority (2026) FCA announces second cohort for AI Live Testing, 21 April.
  9. National Institute of Standards and Technology (2026) NIST advances 9 candidates to the 3rd round of PQC, 14 May.

8. AI Compliance

AI rules are arriving fast, and boards are expected to show they have checked. Our ready-made document packs help you get your AI policies, risk records and evidence in place quickly, in plain English. They support your own legal and compliance advice; they do not replace it.

Free AI Scope CheckAI Compliance packsAztec AI AssessmentAztec AI Readiness

9. DIRECT Framework: Better Decisions, Better Outcomes

Boards rarely fail for lack of information. They fail because decisions are not traceable, defensible or deliverable. DIRECT is the six step method from my book The Board Decision Framework: Define the decision, Identify outcomes, Review options, Evaluate risk, Confirm accountability, Trigger points.

Get the bookRead Chapter 1 free

10. My books

Together, these three books form a single series for boards and executives. AI and quantum computing are advancing at an exponential pace, far faster than the risks most governance frameworks were built for, and their impact reaches every part of the business at once. The Board Decision Framework closes that gap. Its DIRECT method makes critical decisions traceable, defensible and deliverable, with decision evidence that stands up to executive scrutiny, audit review and regulatory challenge.

The Board Decision Framework

The DIRECT method: six steps that make critical decisions traceable, defensible and deliverable. Use it to govern AI, quantum and any major decision.

AI: A Wolf in Sheep's Clothing

The good, the bad and the ugly of AI, in plain English. What boards need to know about AI risk, the questions to ask, and how to stay in control.

Quantum Risk: The Elephant in the Boardroom

Why quantum computing is a board risk today, not tomorrow. How to use the DIRECT framework to mitigate it, what to ask, and when to act.

Visit my Amazon author page

My videos

Short videos on AI governance, risk and the EU AI Act. Click a video to watch it on YouTube.

AI: Agree your strategy to maximise AI investment

AI: Agree your strategy to maximise AI investment

AI: Are you sleep walking into risk?

AI: Are you sleep walking into risk?

AI: We have an AI Governance Problem

AI: We have an AI Governance Problem

Get AI wrong? It could cost 7% of revenue

Get AI wrong? It could cost 7% of revenue

AI is here: Thrive or Die?

AI is here: Thrive or Die?

AI vs Data: The Chicken and the Egg

AI vs Data: The Chicken and the Egg

The EU AI Act: Are you in scope?

The EU AI Act: Are you in scope?

The EU AI Act: Are you ready?

The EU AI Act: Are you ready?

See all videos with titles

Looking back

Useful links

Aztec AI GroupAztec AI ComplianceWhite papers
VideosFollow me on LinkedInForward to a colleague

About Bridget

I'm Bridget Convey, founder of Aztec AI Group, which provides ready-made AI governance tools that turn AI risk into business confidence. For 30 years I have led complex regulatory transformation programmes across banking, insurance and asset management. Today I advise executives and boards on AI and quantum risk, and on making critical decisions traceable, defensible and deliverable. I am ISO/IEC 42001 certified and an alumna of the Oxford Saïd AI Strategy and Leadership Programme.

Aztec AI Group
Bridget Convey Bridget Convey Founder, Aztec AI Group

Aztec AI Group is a trading name of TendoVend Ltd, registered in England and Wales, company number 15906234. Registered office: 79 Mantle Street, Wellington, TA21 8BB. VAT registration 521 4365 19. Some content on this site is produced with the help of AI and checked by Bridget Convey before publication.

info@aztecaigroup.com  ·  aztecaigroup.com  ·  © 2026 TendoVend Limited  ·  FAQs  ·  Contact  ·  Privacy notice